Dashboards & Visualizations
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
Solved! Jump to solution

How to Display a custom Message instead of "No results found" when there is no data for all panels

aditsss
Motivator
‎04-09-2021 07:37 AM

Hi Everyone,

I have one requirement.

I want when there is No DATA in the dashboard currently its showing like "NO RESULTS FOUND" for all the dashboards.

I want to show some custom messages like "Contact to Team"

How can I show that.

Can someone guide me.

 

Labels (3)
Labels
0 Karma
Reply
1 Solution
Solved! Jump to solution
Solution

gcusello
SplunkTrust
SplunkTrust
‎04-09-2021 08:07 AM

Hi @aditsss,

you have to do something like the following example:

<dashboard>
  <label>Your dashboard</label>
  <search id="your_search">
    <query>
      your_search
      | fields your_fields
    </query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
    <progress>
      <condition match="'job.resultCount' == 0">
        <set token="show_html">foob</set>
      </condition>
      <condition>
        <unset token="show_html"></unset>
      </condition>
    </progress>
  </search>
  <row>
    <panel>
      <table rejects="$show_html$">
        <title>Process</title>
        <search base="your_search">
          <query>
            | table your_fields
          </query>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
      <html depends="$show_html$">
        <p style="color:red;margin-left:30px;font-size:24px">No data:</p>
        <br/>
         <p style="color:blue;margin-left:30px;font-size:24px">in search results</p>
      </html>
    </panel>
  </row>
</dashboard>

In few words you have to:

  • put your search as a base search;
  • add to the main search the condition to visualize panel or html;
  • add the condition to your table/chart "rejects";
  • add the html with your message in the panel.

You can find an example of this application in the Splunk Dashboard Eamples App (https://splunkbase.splunk.com/app/1603/) in the dashboard "In page drilldown with perma-linking".

Ciao.

Giuseppe

View solution in original post

Reply
Solved! Jump to solution
Solution

gcusello
SplunkTrust
SplunkTrust
‎04-09-2021 08:07 AM

Hi @aditsss,

you have to do something like the following example:

<dashboard>
  <label>Your dashboard</label>
  <search id="your_search">
    <query>
      your_search
      | fields your_fields
    </query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
    <progress>
      <condition match="'job.resultCount' == 0">
        <set token="show_html">foob</set>
      </condition>
      <condition>
        <unset token="show_html"></unset>
      </condition>
    </progress>
  </search>
  <row>
    <panel>
      <table rejects="$show_html$">
        <title>Process</title>
        <search base="your_search">
          <query>
            | table your_fields
          </query>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
      <html depends="$show_html$">
        <p style="color:red;margin-left:30px;font-size:24px">No data:</p>
        <br/>
         <p style="color:blue;margin-left:30px;font-size:24px">in search results</p>
      </html>
    </panel>
  </row>
</dashboard>

In few words you have to:

  • put your search as a base search;
  • add to the main search the condition to visualize panel or html;
  • add the condition to your table/chart "rejects";
  • add the html with your message in the panel.

You can find an example of this application in the Splunk Dashboard Eamples App (https://splunkbase.splunk.com/app/1603/) in the dashboard "In page drilldown with perma-linking".

Ciao.

Giuseppe

Reply
Solved! Jump to solution

aditsss
Motivator
‎04-09-2021 12:49 PM

@gcusello 

Below is my dashboard query.

Can you guide me how I can achieve this here.

<form theme="dark">
<label>Salesforce User Licenses Dashboard Clone39</label>

<row>
<panel>
<chart>
<title>Overall Salesforce User Licenses</title>
<search>
<query>index="abc" sourcetype="xyz" $type$ TotalLicenses!=0 | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | search $OrgName$ |dedup OrgFolderName, LicenseName, SalesforceOrgId |chart sum(TotalLicenses) as "Total Licenses" sum(UnusedLicenses) as "Unused Licenses" sum(UsedLicenses) as "Used Licenses" by LicenseName</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.maximumNumber">999999</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.scale">log</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">top</option>
<option name="height">400</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>

<row>
<panel>
<table>
<title>Overall Salesforce User Licenses</title>
<search>
<query>index="abc" sourcetype="xyz" $type$ | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | search $OrgName$ |dedup OrgFolderName, LicenseName, SalesforceOrgId |stats sum(TotalLicenses) as "Total-Licenses" sum(UsedLicenses) as "Used Licenses" sum(UnusedLicenses) as "Unused Licenses" by LicenseName OrgName SalesforceOrgId | sort -Total-Licenses</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="count">30</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="rowNumbers">false</option>
<option name="wrap">false</option>
<fields>["LicenseName","OrgName","SalesforceOrgId","Total-Licenses","Used Licenses","Unused Licenses"]</fields>
</table>
</panel>
</row>

</form>

I have 5 panels. How can I do this.

I have posted for two panels. Can you guide me how to achieve this.

Thanks in advance.

0 Karma
Reply
Solved! Jump to solution

gcusello
SplunkTrust
SplunkTrust
‎04-09-2021 01:45 PM

Hi @aditsss,

I did it for the first panel, but you can follow my approach also for the others:

<search id="my_search">
	<query>
		index="abc" sourcetype="xyz" $type$ TotalLicenses!=0 
		| lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName 
		| search $OrgName$ 
		| fields OrgFolderName  LicenseName SalesforceOrgId TotalLicenses UnusedLicensesUsedLicenses
	</query>
	<earliest>$field1.earliest$</earliest>
	<latest>$field1.latest$</latest>
	<progress>
      <condition match="'job.resultCount' == 0">
        <set token="show_html">foob</set>
      </condition>
      <condition>
        <unset token="show_html"></unset>
      </condition>
    </progress>
</search>
<row>
	<panel>
		<chart rejects="$show_html$">
			<title>Overall Salesforce User Licenses</title>
			<search base="my_search">
				<query>
					| lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName 
					| search $OrgName$ 
					| dedup OrgFolderName, LicenseName, SalesforceOrgId |chart sum(TotalLicenses) as "Total Licenses" sum(UnusedLicenses) as "Unused Licenses" sum(UsedLicenses) as "Used Licenses" by LicenseName
				</query>
				<earliest>$field1.earliest$</earliest>
				<latest>$field1.latest$</latest>
			</search>
			<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
			<option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
			<option name="charting.axisTitleX.visibility">visible</option>
			<option name="charting.axisTitleY.text">Count</option>
			<option name="charting.axisTitleY.visibility">visible</option>
			<option name="charting.axisTitleY2.visibility">visible</option>
			<option name="charting.axisX.scale">linear</option>
			<option name="charting.axisY.maximumNumber">999999</option>
			<option name="charting.axisY.minimumNumber">0</option>
			<option name="charting.axisY.scale">log</option>
			<option name="charting.axisY2.enabled">0</option>
			<option name="charting.axisY2.scale">inherit</option>
			<option name="charting.chart">column</option>
			<option name="charting.chart.bubbleMaximumSize">50</option>
			<option name="charting.chart.bubbleMinimumSize">10</option>
			<option name="charting.chart.bubbleSizeBy">area</option>
			<option name="charting.chart.nullValueMode">gaps</option>
			<option name="charting.chart.showDataLabels">all</option>
			<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
			<option name="charting.chart.stackMode">default</option>
			<option name="charting.chart.style">shiny</option>
			<option name="charting.drilldown">all</option>
			<option name="charting.layout.splitSeries">0</option>
			<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
			<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
			<option name="charting.legend.placement">top</option>
			<option name="height">400</option>
			<option name="refresh.display">progressbar</option>
		</chart>
		<html depends="$show_html$">
			<p style="color:red;margin-left:30px;font-size:24px">No data:</p>
			<br/>
			<p style="color:blue;margin-left:30px;font-size:24px">in search results</p>
		</html>
	</panel>
</row>

Anyway, see in the Splunk Dashboard Examples App how to do this.

Ciao.

Giuseppe

0 Karma
Reply
Solved! Jump to solution

aditsss
Motivator
‎04-09-2021 02:08 PM

@gcusello 

I have done something like this:

<row>
<panel>
<chart rejects="$show_html$">
<title>Overall Salesforce User Licenses</title>
<search>
<query>index="abc" sourcetype="xyz" $type$ TotalLicenses!=0 | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | search $OrgName$ |dedup OrgFolderName, LicenseName, SalesforceOrgId |chart sum(TotalLicenses) as "Total Licenses" sum(UnusedLicenses) as "Unused Licenses" sum(UsedLicenses) as "Used Licenses" by LicenseName</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<progress>
<condition match="$job.resultCount$ == 0">
<set token="show_html">true</set>
</condition>
<condition>
<unset token="show_html"/>
</condition>
</progress>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.maximumNumber">999999</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.scale">log</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">top</option>
<option name="height">400</option>
<option name="refresh.display">progressbar</option>
</chart>
<html depends="$show_html$">
<div style="font-weight:bold;font-size:150%;text-align:center;color:red">
If you considered it as Error. Please Contact O2 Monitoring team.
</div>
</html>
</panel>

But from this its showing only at the top . But I want in each and every panel.

How can I achieve this

0 Karma
Reply
Solved! Jump to solution

gcusello
SplunkTrust
SplunkTrust
‎04-09-2021 02:12 PM

Hi @aditsss,

you have to put the search for the condition out of the panel, so if you have results you display the panel , otherwise you display the html box.

If you have more searches put all of them in the top of the dashboard creating a base search for each of them, eventually (if possible) grouping some of them.

Ciao.

Giuseppe

0 Karma
Reply
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...